api-fuzzing-bug-bounty
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
Profile →npx skills add sickn33/agentic-awesome-skills --skill api-fuzzing-bug-bounty --agent claude-code
Same command for any agent — swap --agent for codex, cursor, copilot.
Weekly change comes from our own snapshots, not the repository page — it measures attention, not adoption.
> **⚠️ AUTHORIZED USE ONLY** > This skill is for educational purposes or authorized security assessments only. > You must have explicit, written permission from the system owner before using this tool. > Misuse of this tool is illegal and strictly prohibited. > **Mandatory confirmation gate** > Before running any command that probes, exploits, changes, persists on, extracts data from, or attempts credential access against a target: > 1. Ask the user to state the exact target URL, IP, account, or resource. > 2. Ask the user to confirm written authorization and the permitted scope. > 3. Show the exact command(s) and explain their expected effect. > 4. Wait for explicit confirmation in the current conversation. > > Without that confirmation, remain read-only and provide defensive guidance only. Prefer a sandbox, disposable VM, or controlled lab. > AUTHORIZED USE ONLY: Use this skill only for authorized security assessments, defensive validation, or controlled educational environments. # API Fuzzing for Bug Bounty ## Purpose Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability disco
- Purpose
- Inputs/Prerequisites
- Outputs/Deliverables
- API Types Overview
- Core Workflow
- Step 1: API Reconnaissance
- Step 2: Authentication Testing
- Step 3: IDOR Testing
- Step 4: Injection Testing
- Step 5: Method Testing
- GraphQL-Specific Testing
- Introspection Query
- GraphQL IDOR
- GraphQL SQL/NoSQL Injection
Check for Swagger/OpenAPI documentation Use Kiterunner for API discovery kr scan https://target.com -w routes-large.kite Extract paths from Swagger python3 json2paths.py swagger.json Test different login paths Check rate limiting on auth endpoints If no rate limit → brute force possible Test mobile vs web API separately Basic IDOR
What does the api-fuzzing-bug-bounty skill do?
Provide comprehensive techniques for testing REST, SOAP, and GraphQL APIs during bug bounty hunting and penetration testing engagements. Covers vulnerability discovery, authentication bypass, IDOR exploitation, and API-specific attack vectors.
How do I install it?
Run `npx skills add sickn33/agentic-awesome-skills --skill api-fuzzing-bug-bounty --agent claude-code` — it drops the skill into your project so the agent can pick it up. Swap the --agent value for codex, cursor or copilot if you use one of those.
Where does this skill come from?
From sickn33/agentic-awesome-skills, a repository with 44,414 stars. We read it straight from the repository tree rather than a submitted listing, so what you see here is what is actually published.
Is a popular skill a good skill?
Not necessarily. Stars measure attention, not adoption — a repository can trend for a week and be abandoned. That is why we show the weekly change from our own snapshots next to the total, instead of a single flattering number.